Analysis Overview
SHA256
152265b11b39688bfa5dd656dddacf87c01515f70f62aeb3b1406138a77986d5
Threat Level: Known bad
The file 1c52aed4df30df05a45966183eeef3c2 was found to be: Known bad.
Malicious Activity Summary
Danabot
Danabot Loader Component
Blocklisted process makes network request
Loads dropped DLL
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-12-25 11:54
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-25 11:54
Reported
2023-12-28 05:03
Platform
win10v2004-20231215-en
Max time kernel
141s
Max time network
47s
Command Line
Signatures
Danabot
Danabot Loader Component
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3096 wrote to memory of 3392 | N/A | C:\Users\Admin\AppData\Local\Temp\1c52aed4df30df05a45966183eeef3c2.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 3096 wrote to memory of 3392 | N/A | C:\Users\Admin\AppData\Local\Temp\1c52aed4df30df05a45966183eeef3c2.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 3096 wrote to memory of 3392 | N/A | C:\Users\Admin\AppData\Local\Temp\1c52aed4df30df05a45966183eeef3c2.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\1c52aed4df30df05a45966183eeef3c2.exe
"C:\Users\Admin\AppData\Local\Temp\1c52aed4df30df05a45966183eeef3c2.exe"
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1C52AE~1.TMP,S C:\Users\Admin\AppData\Local\Temp\1C52AE~1.EXE
Network
| Country | Destination | Domain | Proto |
| US | 20.231.121.79:80 | tcp | |
| US | 8.8.8.8:53 | 22.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 4.231.128.59:443 | tcp | |
| US | 8.8.8.8:53 | 174.178.17.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | udp | |
| US | 4.231.128.59:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 92.123.241.104:80 | tcp | |
| N/A | 92.123.241.104:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| GB | 88.221.134.18:80 | tcp | |
| GB | 88.221.134.18:80 | tcp | |
| GB | 88.221.134.18:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| GB | 96.17.178.174:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 88.221.134.42:80 | tcp | |
| N/A | 88.221.134.42:80 | tcp | |
| GB | 88.221.134.18:80 | tcp | |
| GB | 88.221.134.18:80 | tcp | |
| GB | 88.221.134.18:80 | tcp | |
| GB | 96.17.178.176:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| GB | 96.17.178.176:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| GB | 88.221.134.18:80 | tcp | |
| GB | 88.221.134.18:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| GB | 96.17.178.176:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| GB | 96.17.178.176:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 96.16.110.114:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 52.142.223.178:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 87.248.205.0:80 | tcp | |
| N/A | 87.248.205.0:80 | tcp | |
| N/A | 87.248.205.0:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 192.52.166.169:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 96.16.110.114:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 52.142.223.178:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 96.16.110.114:80 | tcp | |
| N/A | 96.16.110.114:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 52.111.227.13:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 20.223.36.55:443 | tcp | |
| N/A | 20.223.36.55:443 | tcp | |
| N/A | 20.223.36.55:443 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 204.79.197.200:443 | tcp | |
| N/A | 204.79.197.200:443 | tcp | |
| N/A | 204.79.197.200:443 | tcp | |
| N/A | 204.79.197.200:443 | tcp | |
| N/A | 204.79.197.200:443 | tcp | |
| US | 192.229.221.95:80 | tcp | |
| N/A | 96.16.110.114:80 | tcp | |
| US | 8.8.8.8:53 | udp | |
| N/A | 96.16.110.114:80 | tcp |
Files
memory/3096-2-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3392-6-0x0000000000CB0000-0x0000000000E0D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1C52AE~1.EXE.tmp
| MD5 | a0d859580c207cce8971fce4f182506f |
| SHA1 | 3f19496d6ecc0479e2fa3a003847e83b4d4eea83 |
| SHA256 | 1bf3e4918cb19698e264aa9c3afdc342ddf9f177408653d7fd56a592fc881e95 |
| SHA512 | d247fd91e718dc37d947c4b742b40cdf852f6dafa74df66701bef7107da35ba54f61ccee4116204ee79f14a53d636242fefb09475eaadd5ffc8a6649008cda74 |
C:\Users\Admin\AppData\Local\Temp\1C52AE~1.EXE.tmp
| MD5 | 7ae3a9cbf8042bfec5feaf668b9f0266 |
| SHA1 | 69f0130b4ae97ec7431f03828e09848d6f100e0e |
| SHA256 | 9abb3412942918086f2c968901275bff6ffdfa00b09e3a8bb24cd8b4a1498e3d |
| SHA512 | e97c8813c36221d437f0daffbe2ac60d00ffa610780c5c2b2a1fe274a36479f8401787936bb337af0405187c68d47e1e916fa088cfaf9719d6dfc78d914c4731 |
C:\Users\Admin\AppData\Local\Temp\1C52AE~1.TMP
| MD5 | 493cd04f6b883b033e5f7801a214c9dc |
| SHA1 | f9fddf5ea2f8824cf7f39ed634a648a8f558f133 |
| SHA256 | dd115d7ce4e04a8a4edcf9c16314d609861665798c2e93cf63b9454269fc9645 |
| SHA512 | fd22efcac62f2b6a44775d58e463278f25aff7e11b549501134ba5046f620f638e84881beccc37ae8ee627f1058c7e7052a1fed0e3d84dd41633619fb5c887b4 |
memory/3392-7-0x0000000000CB0000-0x0000000000E0D000-memory.dmp
memory/3392-15-0x0000000000CB0000-0x0000000000E0D000-memory.dmp
memory/3392-16-0x0000000000CB0000-0x0000000000E0D000-memory.dmp
memory/3392-17-0x0000000000CB0000-0x0000000000E0D000-memory.dmp
memory/3392-18-0x0000000000CB0000-0x0000000000E0D000-memory.dmp
memory/3392-19-0x0000000000CB0000-0x0000000000E0D000-memory.dmp
memory/3392-20-0x0000000000CB0000-0x0000000000E0D000-memory.dmp
memory/3392-21-0x0000000000CB0000-0x0000000000E0D000-memory.dmp
memory/3392-22-0x0000000000CB0000-0x0000000000E0D000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-25 11:54
Reported
2023-12-28 05:03
Platform
win7-20231215-en
Max time kernel
141s
Max time network
122s
Command Line
Signatures
Danabot
Danabot Loader Component
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\1c52aed4df30df05a45966183eeef3c2.exe
"C:\Users\Admin\AppData\Local\Temp\1c52aed4df30df05a45966183eeef3c2.exe"
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1C52AE~1.TMP,S C:\Users\Admin\AppData\Local\Temp\1C52AE~1.EXE
Network
| Country | Destination | Domain | Proto |
| US | 192.52.166.169:443 | tcp |
Files
memory/2436-2-0x0000000000400000-0x000000000050A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1C52AE~1.TMP
| MD5 | c6a1acce3f89edea61b44ecf55dbc003 |
| SHA1 | c5f07041f44922269d6b343f67683d9d343bda46 |
| SHA256 | 0abf70595efc6d1013e0edc1cc6208df3291db180a41814b367bda9b2f741441 |
| SHA512 | 1d43df1ca71689e4c56b9c6292ccf75165c0724ebc82483d65eda8d4534e15964d53dc99158172457962e2a4850f58b58509bab0d7233d5002d850cd746b1843 |
memory/2200-5-0x00000000020F0000-0x000000000224D000-memory.dmp
memory/2200-6-0x00000000020F0000-0x000000000224D000-memory.dmp
memory/2200-14-0x00000000020F0000-0x000000000224D000-memory.dmp
memory/2200-15-0x00000000020F0000-0x000000000224D000-memory.dmp
memory/2200-16-0x00000000020F0000-0x000000000224D000-memory.dmp
memory/2200-17-0x00000000020F0000-0x000000000224D000-memory.dmp
memory/2200-18-0x00000000020F0000-0x000000000224D000-memory.dmp
memory/2200-19-0x00000000020F0000-0x000000000224D000-memory.dmp
memory/2200-20-0x00000000020F0000-0x000000000224D000-memory.dmp
memory/2200-21-0x00000000020F0000-0x000000000224D000-memory.dmp